The continuous development of the computer technology has led to the widespread use of computers in daily life at the present time. The computer, with its ever increasing functionalities, has become an indispensable tool for one's leisure and work. However, sophisticated attack techniques have been utilized by individuals and organizations to persistently attack particular targets over networks. The attack may execute malicious codes and lead to the disclosure of sensitive information, and threaten the network security.
There are two existing methods for detecting a malware file, a static detection method and a dynamic detection method. The static detection method is used more often, and includes two approaches: detecting an abnormal file a) through a file type abnormality, and b) through characteristics associated with a software fault utilizing file. The dynamic detection method is a heuristic detection method. A file is executed under a more advanced heuristic condition in a simulated environment to detect behaviors not associated with a regular file. If the file triggers a shellcode (filled data belonging to a bug code), it will show behaviors that cannot be contributed to the file, for example, a network connection, a program execution, or a process injection.
However, the static detection method can easily be bypassed by constructing the file structure and modifying the shellcode. Therefore, the static detection method has a dismal ability to heuristically detect and destroy malware files, and is incapable of detecting and destroying newly emerged malware files. For the dynamic detection method, there are various ways of detecting the virtual dynamic execution environment to not trigger relevant viral codes, leading to the failure in detection. Therefore, although the dynamic detection method has limited heuristic ability, the efficiency and the detection speed are relatively low and the heuristic ability is not as high as desired.